Assessing The Fire Risk For A Historic Hangar 


Koushik Datta; NASA 
Richard S. Morrison; NASA 

Key Words: Risk Assessment, Event Tree, Fire Suppression, Hangar 


SUMMARY & CONCLUSIONS 

NASA Ames Research Center (ARC) is evaluating 
options of reuse of its historic Hangar 1. As a part of this 
evaluation, a qualitative fire risk assessment study was 
performed to evaluate the potential threat of combustion of the 
historic hangar. The study focused on the fire risk trade-off of 
either installing or not installing a Special Hazard Fire 
Suppression System in the Hangar 1 deck areas. 

The assessment methodology was useful in discussing the 
important issues among various groups within the Center. 
Once the methodology was deemed acceptable, the results 
were assessed. The results showed that the risk remained in 
the same risk category, whether Hangar 1 does or does not 
have a Special Hazard Fire Suppression System. Note that the 
methodology assessed the risk to Hangar 1 and not the risk to 
an aircraft in the hangar. If one had a high value aircraft, the 
aircraft risk analysis could potentially show a different result. 

The assessed risk results were then communicated to 
management and other stakeholders. 

1 INTRODUCTION 

In the early 1930s the Naval Air Station Sunnyvale, 
California was commissioned to house the US S Macon, a U.S. 
Naval Airship (dirigible). It is now part of a Historic District 
[1] consisting of a large number of buildings that were 
constructed from the 1930s on. By far the most famous and 
visible site is Hangar 1 which is visible from the nearby 
freeways and from the air. Hangar 1 housed the USS Macon, 
and was named as a Naval Historical Monument in the early 
1950s. The floor covers eight acres and can accommodate 10 
football fields; it is 1,133 feet long and 308 feet wide with 
walls forming an elongated dome 198 feet high. 

Hangar 1 is the center of a debate over its future as its 
external structure was leaking toxic chemicals into the ground 
water. The US Navy has coated the exterior panels with an 
encapsulant and is evaluating options for remediating the toxic 
chemicals permanently. During this process, NASA ARC is 
evaluating options for the maximum practicable use of Hangar 
1 subsequent to its proposed restoration. Potential uses of the 
hangar include storage and light, non-hazardous maintenance 
(unftieled air vehicles and no hot work allowed in the hangar) 
of air vehicles (e.g. fixed-wing aircraft, helicopters, and/or 
rigid/non-rigid airships), and special short-term events such as 
public engagements. The plan is to restore Hangar 1 to all 


current codes but assess the need for a Special Hazard Fire 
Suppression System (like, hangar floor sprinklers or under 
wing deluge system). The building code allows the exception 
of Special Hazard Fire Suppression Systems under certain 
circumstances. The California State Historic Preservation 
Office recommended a risk assessment be performed to 
evaluate the potential threat to the hangar of activities 
performed inside of it. 

This paper provides an overview of the resulting fire risk 
assessment performed at NASA ARC in relation to the 
renovation of the historic hangar 1 . 

2 METHODOLOGY 

The goal was to assess the alternatives in a 5x5 risk 
matrix. Managers at NASA ARC are comfortable with using 
these risk matrices in making risk informed decisions. 
Although routine in the aerospace program/project arena, this 
risk informed decision making approach is gaining a strong 
foothold in institutional or facility modification projects. 

This was a limited-scope fire risk assessment for Hangar 
1. The trade space was an analysis of the risk of major hangar 
fire with and without a Special Hazard Fire Suppression 
System for Hangar 1 . 

The authors chose to use the framework of a probabilistic 
risk analysis, consisting of event trees and fault trees. Potential 
accident sequences for a fire in Hangar 1 were developed in 
the SAPHIRE [2] software code by developing event and fault 
trees. The event tree displays an initiating event, which 
disrupts normal operations, followed by a sequence of events 
(in time) involving success and/or failure of system 
components. Each path in the event tree is an accident 
scenario sequence of systems that either succeed or fail during 
the accident sequence. 

Each accident sequence was assessed in terms of its 
consequence and likelihood. The consequence is an 
assessment of the worst credible potential result. The 
likelihood is the probability that the identified accident 
sequence will occur. 

Initially, three event trees were created to assess: 

• Aircraft Initiated Fire Risks in the Hangar 

• Airship Initiated Fire Risks in the Hangar 

• Short Term Special Event Fire Risks in the Hangar 

These event trees resulted in various event sequences that 

had consequences of major damage to the hangar, minor 
damage, and negligible damage. An example initial event tree 



is shown in section 4. The event sequences resulting from a 
major hangar fire were evaluated further in two subsequent 
event trees — one with a Special Hazard Fire Suppression 
System, and another without any Special Hazard Fire 
Suppression System (see sections 5 and 6). 

Fault trees were generated for all initiating events and 
some pivotal events. They were used to generate the 
probabilities of the events in the various event trees. For 
reasons of conciseness, this paper only shows some of the 
event trees and none of the fault trees. 

The consequences in the two event trees with and without 
Special Hazard Fire Suppression System were classified as 
Catastrophic, Critical, Major, Minor, and Negligible. 
Likelihoods were classified as Likely to occur, Probably will 
occur, May Occur, Unlikely to occur, and Improbable to 
occur, in the life of the facility, which for the purposes of this 
analysis is assumed to be approximately thirty years. 

Given the consequence and likelihood, the risk 
assessment code is obtained from a 5x5 risk matrix shown in 
Figure 4. The risk is qualitatively rated as high, medium, or 
low (shown as red, yellow, or green in the matrix). 

3 ASSUMPTIONS 

Some of the major assumptions of the study are listed 
here: 

• It is assumed that the current Hangar 1 will be 
completely renovated as per the Navy’s Engineering 
Evaluation. All new structure, material and 
components will be up to the current fire codes that 
include adequate fire detection, alarms and water 
supply system to the fire hoses. The hangar roof will 
be accessible to firefighters as part of the upgrades. 

• The fire alarm system will have direct 
communication with the ARC Emergency Dispatch 


Center and the on-base Fire Station. 

• Future operations within Hangar 1 are limited to light 
maintenance and storage of aircraft and airships, and 
short term special events. 

• All Hangar 1 auxiliary shops and offices after 
proposed renovations are assumed to be code 
compliant. 

• Only fire risk was assessed for the hangar area, due to 
initiating events either in the hangar area or in an 
aircraft, airship or special event. Initiating fire events 
in office spaces are covered by the fire codes and 
were not addressed in the study. Other initiating 
events, like seismic or storm events, were not 
assessed. 

• Discussions with cognizant ARC personnel suggest 
that a Special Hazard Fire Suppression System will 
not be effective against a fire of the hangar itself, due 
to the hangar’s very large volume and significant 
height and width. The effectiveness of a Special 
Hazard Fire Suppression System could not be 
quantified; however, it was conservatively judged by 
the authors to have a fifty-fifty effectiveness. 

4 INITIAL EVENT TREES 

This section shows one of the three initial event trees (see 
Section 2) as an illustration of the methodology. The event 
tree for an aircraft initiated risk of a “Major fire in Hangar 1” 
is shown in Figure 1. 

The initiating event is that a local fire starts in an aircraft 
that is stored in the renovated hangar 1. This is assessed to be 
“Probable” in the life of the hangar. Local fire detection, 
meaning within the aircraft, occurs with a high probability. 
When detected, the ARC Emergency Dispatch Center is also 
alerted by phone. If the local-to-the-aircraft fire fighting (e.g., 
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Figure 1 - Event Tree for Aircraft Initiated Hangar 1 Fire Risk 


personnel with fire extinguishers) is effective on the unfueled 
aircraft, it results in sequence #1 with a “Negligible Damage” 
consequence and a “Probable” likelihood in the life of the 
hangar. Event sequence #1 occurs whether or not there is a 
Special Hazard Fire Suppression System and this risk is shown 
in the risk assessment matrix of Figure 4. 

Event sequence #2 occurs if local fire fighting is 
ineffective and this results in a “Major fire in Hangar 1.” 
Event sequence #3 occurs if the fire is not detected in time so 
that this event sequence also results in a “Major fire in Hangar 
1.” These two event sequences show that an aircraft related 
fire initiating event can spread and become a “Major fire in 
Hangar 1” with a “May Occur” likelihood in the life of the 
hangar. 

These sequences feed the initiating event in event trees of 
“Fire Risk of Hangar 1 without any Special Hazard Fire 
Suppression System” (Figure 2) and “Fire Risk of Hangar 1 
with a Special Hazard Fire Suppression System” (Figure 3). 

Note that the event tree of Figure 1 does not include the 
ARC Fire Department's effectiveness in fighting the fire — 
they are included in the event trees of Figures 2 and 3. 

As mentioned in the methodology section, the study 
included initial event trees for “Airship Initiated Fire Risks in 
the Hangar” and “Short Term Special Event Fire Risks in the 
Hangar.” Those initial event trees are not shown in this paper, 
but they both had "Major fire in Hangar 1" sequences with 
"May Occur" likelihoods. The “Major fire in Hangar 1” 
sequences from all three initial event trees feed the event trees 
of Figures 2 and 3. 

5 RENOVATED HANGAR 1 WITHOUT ANY SPECIAL 
HAZARD FIRE SUPPRESSION SYSTEMS 

This section assesses the first option in the trade study. 
Here it is assumed that the proposed renovated Hangar 1 will 
not have any Special Hazard Fire Suppression System like 


hangar floor sprinklers or under wing deluge system. 

The event tree in Figure 2 represents event sequences in 
this trade study option that could lead to fire damage of 
Hangar 1 where the initiating event is a “Major fire in Hangar 
1.” The likelihood of this initiating event was assessed to be as 
“May Occur” in the life of the hangar from an assessment of 
the three event trees as described in the previous section. 

The first branch that occurs in the event tree is fire 
detection. One can get to this state with a locally undetected 
fire (event sequence #3, Figure 1). Hence, this fire detection 
event is different from the local fire detection event in the 
initial event tree of Figure 1. Once the fire grows big enough it 
can be detected outside the aircraft by the hangar fire detection 
system. It was assessed that there is a high probability that a 
major fire in the hangar would be successfully detected by the 
new fire detection/alarm system, conversely it was assessed 
that there is a low probability that fire detection would fail. 

No branching occurs at the second branch since there is 
no Special Hazard Fire Suppression System. 

At the third branch, if the fire is detected the alarm is set- 
off and the ARC Emergency Dispatch Center is notified. Since 
the ARC fire station is very close to Hangar 1 , the response (if 
ARC Fire Department resources are in quarters and not 
assigned to another emergency incident) should be immediate 
and the team assessed that fire fighting should be effective 
with a high probability occurrence; and only with a low 
probability that fire fighting would be ineffective. 

In the upper part of the event tree (Figure 2), a major fire 
occurrence with effective fire fighting (event sequence #1) 
was assessed to result in “Major damage” as a consequence 
with likelihood that it “May Occur” in the life of the hangar. A 
major fire with ineffective fire fighting (event sequence #2) 
was assessed to result in “Critical Damage” as a consequence 
with a likelihood of “Unlikely” to occur in the life of the 
hangar. In the lower part of the event tree, if the major fire is 
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Figure 2 - Event Tree for Fire Risk of Hangar 1 without any Special Hazard Fire Suppression System 


not detected automatically, it eventually will get detected by 
personnel and the fire station notified. However, the 
notification is relatively late in this case (as compared to when 
the fire is automatically detected and the fire station is 
automatically notified). So in this case late effective fire 
fighting results in “Critical Damage” (event sequence #3). 
Otherwise ineffective fire fighting (event sequence #4) would 
result in “Catastrophic Damage” to the hangar, which was 
judged to have an “Improbable” likelihood of occurrence in 
the life of the hangar. 

The resulting consequence / likelihood of these accident 
sequence scenarios are shown in the risk matrix of Figure 4. 

6 RENOVATED HANGAR 1 WITH SPECIAL HAZARD FIRE 
SUPPRESSION SYSTEMS 

This section assesses the second option in the trade study. 
Here it is assumed that the proposed renovated Hangar 1 has a 
Special Hazard Fire Suppression System. The event tree is 
shown in Figure 3. 

The initiating event (a major fire in hangar) in this event 
tree represents the same initiating event used in the previous 
event tree (Figure 2). The first pivotal event is fire detection 


and it is the same in both event trees. 

The second pivotal event is different in the two event 
trees because of inclusion of the Special Hazard Fire 
Suppression System. In this event branch, if the fire 
suppression system is effective (event sequence #1, Figure 3), 
it results in “Minor Damage” to the hangar with a “May 
Occur” likelihood of occurrence in the life of the hangar. The 
probabilities are obtained from one of the major assumptions 
in section 2. 

If the fire suppression system is not effective, fire fighting 
efforts (event sequence #2, Figure 3) were judged to have a 
high probability of limiting the fire damage. This pivotal event 
is the same as in Figure 2. Event sequences 2 and 3 are 
assessed to have “Major damage” and “Critical damage,” 
respectively — just like in Figure 2. These event sequences 
also occur with the same likelihood, the reason being that the 
probabilities are reduced by a factor of two but not by an order 
of magnitude. When fire is not detected automatically, the 
lower part of the event tree of Figure 3, the accident sequences 
are identical to previous event tree of Figure 2. 

The resulting consequence likelihood of these accident 
sequence scenarios are shown in the risk matrix of Figure 4. 
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Figure 3 - Event Tree for Fire Risk of Hangar 1 with a Special Hazard Fire Suppression System 


7 CONCLUSION 

Consequences and likelihoods of all event sequences in 
the three initial event trees and the two trade study options 
(with & without Special Hazard Fire Suppression System) are 
displayed in the risk matrix of Figure 4. Other assessed risks 
lower in either consequence and/or likelihood are not shown in 
Figure 4. In essence, this risk matrix only shows the largest 
risk boundary. 

Examination of the risk matrix shows that there is very 
little difference between the two options in terms of their 
highest severity risk category — they are both yellow 


reflecting a medium level of risk. Therefore, installation of a 
Special Hazard Fire Suppression System does not appear to 
reduce the risk category of a major fire in the hangar. In most 
ARC applications, this risk can be accepted by a 
project/facility with suitable examination of the accident 
sequences and their risk management plan. Sensitivity analysis 
on the major assumptions showed only small differences with 
no change in the overall result. 

The risk assessment process was very useful in discussing 
the important issues between the Facilities Engineering 
Division, Fire Protection Office, and the Safety and Mission 
Assurance Directorate. The assessed risks were communicated 


using the risk matrix to upper management. After internal State Historic Preservation Office. It was accepted by the 
review, the risk assessment was provided to the California California State Historic Preservation Officer. 
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